GHSA-97WV-P4XX-C7MG
Vulnerability from github – Published: 2026-10-20 18:23 – Updated: 2026-10-20 18:23Summary
The tar-extraction guard added to @apostrophecms/import-export for GHSA-mwxc-m426-3f78 is a literal substring test for ../, and ./.. does not contain that substring. An entry named ./.. therefore passes the guard, path.join normalizes it to the parent of the export directory, and the resulting fs.WriteStream opens a directory and emits EISDIR with no error listener attached, which terminates the Node process.
Confirmed on default-branch HEAD 1bd5d0a7a6fe880836fa75adad6964f1c577d640, package version 3.6.2.
Details
packages/import-export/lib/formats/gzip.js, in the tar-stream entry handler inside extract(filepath, exportPath):
const name = header.name.replace(/\\/g, '/');
if (name.includes('../')) {
// skipped
}
...
stream.pipe(fs.WriteStream(path.join(exportPath, name)));
Two separate problems sit in those four lines. The guard tests the raw entry name for a substring instead of resolving the joined path and requiring containment, and the write stream has no error handler, so any stream error becomes an unhandled 'error' event.
Reaching it needs an account that can import, nothing more. packages/import-export/modules/@apostrophecms/import-export-page/index.js exposes post.importExportImport, which calls into lib/methods/import.js; that handler requires req.user and then calls format.input(exportPath), which for a .gz upload is gzip.js calling extract() on the uploaded archive.
PoC
This is not an end-to-end exploit. What follows is each of the three primitives the crash depends on, executed individually, plus a source-level trace of the route. The chain from post.importExportImport to extract() was read, not observed.
The guard misses the payload:
node -e "console.log('./..'.includes('../')); console.log('..'.includes('../')); console.log('a/./..'.includes('../'));"
false
false
false
path.join then resolves it out of the export directory:
node -e "const path=require('path'); const exportPath='/tmp/exportRoot'; console.log(path.join(exportPath,'./..'));"
/tmp
And a write stream opened on a directory, with no error listener, kills the process rather than failing the request:
node -e "const fs=require('fs'); const s=fs.createWriteStream('/tmp'); s.write('x'); s.end(); setTimeout(()=>console.log('still alive'),500);"
events.js:291
throw er; // Unhandled 'error' event
^
Error: EISDIR: illegal operation on a directory, open '/tmp'
Emitted 'error' event on WriteStream instance at:
at internal/fs/streams.js:361:12
at FSReqCallback.oncomplete (fs.js:156:23) {
errno: -21,
code: 'EISDIR',
syscall: 'open',
path: '/tmp'
}
The events.js:291 frame shows that transcript came off the Node 14 line my audit box had. The unhandled-error-event behavior is not version specific, but the exact message on your supported Node versions is worth a re-run.
Source-side confirmation without running anything:
grep -n "includes('../')" packages/import-export/lib/formats/gzip.js
grep -n "WriteStream" packages/import-export/lib/formats/gzip.js
Impact
An authenticated user who can reach the import UI uploads one crafted archive and takes down the Node process handling it. Every worker that picks up such an archive dies the same way.
Suggested fix
Resolve the target and require containment, and attach an error handler:
const base = path.resolve(exportPath);
const target = path.resolve(path.join(exportPath, name));
if (target !== base && !target.startsWith(base + path.sep)) {
stream.on('end', next);
stream.resume();
return;
}
if (header.type === 'directory') {
fsp.mkdir(target).then(next).catch(reject);
} else {
const out = fs.WriteStream(target);
out.on('error', reject);
stream.pipe(out);
stream.on('end', next);
}
The error handler earns its place independently. Any tar entry that lands on an existing directory name has the same effect whether or not traversal is involved.
Why this is not GHSA-mwxc-m426-3f78
The name.includes('../') check is the mitigation shipped for GHSA-mwxc-m426-3f78 / CVE-2026-32731. It stops names carrying the literal ../ sequence. It does not canonicalize the joined path, so ./.. and a bare .. still get through, and it did not touch the missing error listener. This report is about what the substring test leaves behind.
AI assistance was used for the code audit and drafting. The exact guard and WriteStream lines in packages/import-export/lib/formats/gzip.js at the stated HEAD were manually verified, the import route from the page module through lib/methods/import.js into the entry handler were manually traced, and the three Node one-liners were manually ran and copied verbatim.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@apostrophecms/import-export"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-113664"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-20T18:23:42Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\n\nThe tar-extraction guard added to `@apostrophecms/import-export` for GHSA-mwxc-m426-3f78 is a literal substring test for `../`, and `./..` does not contain that substring. An entry named `./..` therefore passes the guard, `path.join` normalizes it to the parent of the export directory, and the resulting `fs.WriteStream` opens a directory and emits `EISDIR` with no `error` listener attached, which terminates the Node process.\n\nConfirmed on default-branch HEAD `1bd5d0a7a6fe880836fa75adad6964f1c577d640`, package version `3.6.2`.\n\n### Details\n\n`packages/import-export/lib/formats/gzip.js`, in the tar-stream `entry` handler inside `extract(filepath, exportPath)`:\n\n```js\nconst name = header.name.replace(/\\\\/g, \u0027/\u0027);\nif (name.includes(\u0027../\u0027)) {\n // skipped\n}\n...\nstream.pipe(fs.WriteStream(path.join(exportPath, name)));\n```\n\nTwo separate problems sit in those four lines. The guard tests the raw entry name for a substring instead of resolving the joined path and requiring containment, and the write stream has no `error` handler, so any stream error becomes an unhandled `\u0027error\u0027` event.\n\nReaching it needs an account that can import, nothing more. `packages/import-export/modules/@apostrophecms/import-export-page/index.js` exposes `post.importExportImport`, which calls into `lib/methods/import.js`; that handler requires `req.user` and then calls `format.input(exportPath)`, which for a `.gz` upload is `gzip.js` calling `extract()` on the uploaded archive.\n\n### PoC\n\nThis is not an end-to-end exploit. What follows is each of the three primitives the crash depends on, executed individually, plus a source-level trace of the route. The chain from `post.importExportImport` to `extract()` was read, not observed.\n\nThe guard misses the payload:\n\n```bash\nnode -e \"console.log(\u0027./..\u0027.includes(\u0027../\u0027)); console.log(\u0027..\u0027.includes(\u0027../\u0027)); console.log(\u0027a/./..\u0027.includes(\u0027../\u0027));\"\n```\n\n```text\nfalse\nfalse\nfalse\n```\n\n`path.join` then resolves it out of the export directory:\n\n```bash\nnode -e \"const path=require(\u0027path\u0027); const exportPath=\u0027/tmp/exportRoot\u0027; console.log(path.join(exportPath,\u0027./..\u0027));\"\n```\n\n```text\n/tmp\n```\n\nAnd a write stream opened on a directory, with no `error` listener, kills the process rather than failing the request:\n\n```bash\nnode -e \"const fs=require(\u0027fs\u0027); const s=fs.createWriteStream(\u0027/tmp\u0027); s.write(\u0027x\u0027); s.end(); setTimeout(()=\u003econsole.log(\u0027still alive\u0027),500);\"\n```\n\n```text\nevents.js:291\n throw er; // Unhandled \u0027error\u0027 event\n ^\n\nError: EISDIR: illegal operation on a directory, open \u0027/tmp\u0027\nEmitted \u0027error\u0027 event on WriteStream instance at:\n at internal/fs/streams.js:361:12\n at FSReqCallback.oncomplete (fs.js:156:23) {\n errno: -21,\n code: \u0027EISDIR\u0027,\n syscall: \u0027open\u0027,\n path: \u0027/tmp\u0027\n}\n```\n\nThe `events.js:291` frame shows that transcript came off the Node 14 line my audit box had. The unhandled-`error`-event behavior is not version specific, but the exact message on your supported Node versions is worth a re-run.\n\nSource-side confirmation without running anything:\n\n```bash\ngrep -n \"includes(\u0027../\u0027)\" packages/import-export/lib/formats/gzip.js\ngrep -n \"WriteStream\" packages/import-export/lib/formats/gzip.js\n```\n\n### Impact\n\nAn authenticated user who can reach the import UI uploads one crafted archive and takes down the Node process handling it. Every worker that picks up such an archive dies the same way.\n\n### Suggested fix\n\nResolve the target and require containment, and attach an error handler:\n\n```js\nconst base = path.resolve(exportPath);\nconst target = path.resolve(path.join(exportPath, name));\n\nif (target !== base \u0026\u0026 !target.startsWith(base + path.sep)) {\n stream.on(\u0027end\u0027, next);\n stream.resume();\n return;\n}\n\nif (header.type === \u0027directory\u0027) {\n fsp.mkdir(target).then(next).catch(reject);\n} else {\n const out = fs.WriteStream(target);\n out.on(\u0027error\u0027, reject);\n stream.pipe(out);\n stream.on(\u0027end\u0027, next);\n}\n```\n\nThe error handler earns its place independently. Any tar entry that lands on an existing directory name has the same effect whether or not traversal is involved.\n\n### Why this is not GHSA-mwxc-m426-3f78\n\nThe `name.includes(\u0027../\u0027)` check is the mitigation shipped for GHSA-mwxc-m426-3f78 / CVE-2026-32731. It stops names carrying the literal `../` sequence. It does not canonicalize the joined path, so `./..` and a bare `..` still get through, and it did not touch the missing `error` listener. This report is about what the substring test leaves behind.\n\n\nAI assistance was used for the code audit and drafting. The exact guard and `WriteStream` lines in `packages/import-export/lib/formats/gzip.js` at the stated HEAD were manually verified, the import route from the page module through `lib/methods/import.js` into the entry handler were manually traced, and the three Node one-liners were manually ran and copied verbatim.",
"id": "GHSA-97wv-p4xx-c7mg",
"modified": "2026-10-20T18:23:42Z",
"published": "2026-10-20T18:23:42Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-97wv-p4xx-c7mg"
},
{
"type": "WEB",
"url": "https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce"
},
{
"type": "WEB",
"url": "https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350"
},
{
"type": "PACKAGE",
"url": "https://github.com/apostrophecms/apostrophe"
},
{
"type": "WEB",
"url": "https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "ApostropheCMS import-export tar guard misses \u0027./..\u0027 because it is a literal \u0027../\u0027 substring test"
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.